SuSE 11.2 Security Update : MozillaFirefox (SAT Patch Number 8545)

critical Nessus Plugin ID 70935

Language:

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

Mozilla Firefox was updated to the 17.0.10ESR release, fixing various bugs and security issues :

- Mozilla developers identified and fixed several memory safety bugs in the browser engine used in Firefox and other Mozilla-based products. Some of these bugs showed evidence of memory corruption under certain circumstances, and we presume that with enough effort at least some of these could be exploited to run arbitrary code. (MFSA 2013-93)

Jesse Ruderman and Christoph Diehl reported memory safety problems and crashes that affect Firefox ESR 17, Firefox ESR 24, and Firefox 24.
(CVE-2013-5590)

Carsten Book reported a crash fixed in the NSS library used by Mozilla-based products fixed in Firefox 25, Firefox ESR 24.1, and Firefox ESR 17.0.10. (CVE-2013-1739)

- Security researcher Abhishek Arya (Inferno) of the Google Chrome Security Team used the Address Sanitizer tool to discover an access violation due to uninitialized data during Extensible Stylesheet Language Transformation (XSLT) processing. This leads to a potentially exploitable crash. (MFSA 2013-95 / CVE-2013-5604)

- Compiler Engineer Dan Gohman of Google discovered a flaw in the JavaScript engine where memory was being incorrectly allocated for some functions and the calls for allocations were not always properly checked for overflow, leading to potential buffer overflows. When combined with other vulnerabilities, these flaws could be potentially exploitable. (MFSA 2013-96 / CVE-2013-5595)

- Security researcher Byoungyoung Lee of Georgia Tech Information Security Center (GTISC) used the Address Sanitizer tool to discover a use-after-free during state change events while updating the offline cache. This leads to a potentially exploitable crash. (MFSA 2013-98 / CVE-2013-5597)

- Security researcher Nils used the Address Sanitizer tool while fuzzing to discover missing strong references in browsing engine leading to use-after-frees. This can lead to a potentially exploitable crash. (MFSA 2013-100)

- ASAN heap-use-after-free in nsIPresShell::GetPresContext() with canvas, onresize and mozTextStyle. (CVE-2013-5599)

- ASAN use-after-free in nsIOService::NewChannelFromURIWithProxyFlags with Blob URL. (CVE-2013-5600)

- ASAN use-after free in GC allocation in nsEventListenerManager::SetEventHandler (CVE-2013-5601) MFSA 2013-101 / CVE-2013-5602: Security researcher Nils used the Address Sanitizer tool while fuzzing to discover a memory corruption issue with the JavaScript engine when using workers with direct proxies. This results in a potentially exploitable crash.

Solution

Apply SAT patch number 8545.

Plugin Details

Severity: Critical

ID: 70935

File Name: suse_11_firefox-201310-131109.nasl

Version: 1.6

Type: local

Agent: unix

Family: SuSE Local Security Checks

Published: 11/17/2013

Updated: 1/19/2021

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:mozillafirefox-translations, cpe:/o:novell:suse_linux:11, p-cpe:/a:novell:suse_linux:11:mozillafirefox, p-cpe:/a:novell:suse_linux:11:mozillafirefox-branding-sled

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Patch Publication Date: 11/9/2013

Reference Information

CVE: CVE-2013-1739, CVE-2013-5590, CVE-2013-5595, CVE-2013-5597, CVE-2013-5599, CVE-2013-5600, CVE-2013-5601, CVE-2013-5602, CVE-2013-5604

Detections

Analytics